Hbkernel32.sys, 53u1ttme. 2ys, hbtl. dll, hbso2.dll, bcejnmfd. dll, etc. 1

Hbkernel32.sys, 53u1ttme. 2ys, hbtl. dll, hbso2.dll, bcejnmfd. dll, etc. 1

 

Original endurer
1st-

 

Yesterday, a colleague said that after the computer was turned on, the desktop was blank and the taskbar and desktop icons were not displayed. Please try again.

The task manager check is opened on the same computer, and no suspicious progress is found. In addition, erer.exe is running.

Run assumer.exeand stop the Job Manager. Try to run cmd.exeand winrar.exe.

Just restart the computer to the security mode, computation with msconfig.exeto check the startup Item, not to mention msconfig.exe. You only need to directly run the registration table editor regedit.exe to check.

Soon I found out:

O4-HKLM/../run: [hbservice32] system.exe

Confirm that the bid is successful. Change the value to "cmdsystem.exe ".

Remember that there is another service item in this item. Find and change the startup mode to 4 (disabled ):

 

O23-service: hbkernel32 (hbkernel32 driver)-system32/Drivers/hbkernel32.sys | 5:12:50 (disabled)

Restart the computer, and the desktop shows normal.

Download the pe_xscan scan log and analyze it. The following suspicious items are found (the process module is omitted ):

 

Pe_xscan 08-08-01 by Purple endurer

Windows XP Service Pack 3 (5.1.2600)
MSIE: 7.0.5730.11
Administrator user group
Normal Mode

[System process] * 0
C:/Windows/system32/hbtl. dll | 5:14:38
C:/program files/Internet Explorer/53u1ttme. 2ys | 5:22:48
C:/Windows/system32/ozmazluz. dll | 5:18:21
C:/Windows/system32/bcejnmfd. dll |
C:/Windows/system32/uhtcnwqw. dll | 5:17:19
C:/Windows/system32/tpphbrik. dll | 5:15:59
C:/Windows/system32/flirxttw. dll | 5:15:39
C:/Windows/system32/winlogon.exe * 956 |
C:/Windows/system32/hbso2.dll | 5:13:56
C:/Windows/system32/hbtl. dll | 5:14:38
C:/Windows/system32/services.exe * 1004 |
C:/Windows/system32/hbso2.dll | 5:13:56
C:/Windows/system32/hbtl. dll | 5:14:38
C:/Windows/system32/lsass.exe * 1016 |
C:/Windows/system32/hbso2.dll | 5:13:56
C:/Windows/system32/hbtl. dll | 5:14:38
O2-BHO-{F6A454AE-156A-415E-9F89-3795677A8A91} = C:/program files/Internet Explorer/53u1ttme. 2ys | 5:22:48
O4-HKLM/../run: [hbservice32] Using system.exe
O4-HKLM/../policies/Explorer/run: [nwiz] aliware.exe
O20-appinit_dlls = hbmhly. dll, hbso2.dll, hbsoul. dll, hbdnf. dll, hbwow. dll, hbtl. dll
O21-ssodl-flirxttw. dll (0)-{F0930A2F-D971-4828-8209-B7DFD266ED44} = C:/Windows/system32/flirxttw. dll | 5:15:39
O21-ssodl-tpphbrik. dll (B)-{A2C3BA54-DF75-4881-8EB3-E54B26BBBBC9} = C:/Windows/system32/tpphbrik. dll | 5:15:59
O21-ssodl-uhtcnwqw. dll (3)-{DA56B183-A731-402b-9235-2CB8803E212D} = C:/Windows/system32/uhtcnwqw. dll | 5:17:19
O21-ssodl-bcejnmfd. dll (1)-{2cb77746-8ecc-40ca-8217-10ca8be5efc8} = C:/Windows/system32/bcejnmfd. dll |
O21-ssodl-ozmazluz. dll (B)-{41056902-6e7b-4bd7-95ba-688db5fa5beb} = C:/Windows/system32/ozmazluz. dll | 5:18:21
O23-service: aliimz ()-system32/Drivers/aliimz. sys (manual)
O23-service: beep (beep)-C:/Windows/system32/Drivers/beep. sys | 13:12:45 (disabled)
O23-service: hbkernel32 (hbkernel32 driver)-system32/Drivers/hbkernel32.sys | 5:12:50 (disabled)
O23-service: IIS Manager-C:/iis e ~ 1/New/locals ~ 1/temp/1.tmp (manual)
O23-service: sznb (sznb)-C:/06574ffe/06575006 (manual)
O24-shlexechook: [4]-{F0930A2F-D971-4828-8209-B7DFD266ED44} = C:/Windows/system32/flirxttw. dll | 5:15:39
O24-shlexechook: [9]-{A2C3BA54-DF75-4881-8EB3-E54B26BBBBC9} = C:/Windows/system32/tpphbrik. dll | 5:15:59
O24-shlexechook: [d]-{DA56B183-A731-402b-9235-2CB8803E212D} = C:/Windows/system32/uhtcnwqw. dll | 5:17:19
O24-shlexechook: [8]-{2cb77746-8ecc-40ca-8217-10ca8be5efc8} = C:/Windows/system32/bcejnmfd. dll |
O24-shlexechook: [B]-{41056902-6e7b-4bd7-95ba-688db5fa5beb} = C:/Windows/system32/ozmazluz. dll | 5:18:21
O24-shlexechook: []-{F6A454AE-156A-415E-9F89-3795677A8A91} = C:/program files/Internet Explorer/53u1ttme. 2ys | 5:22:48

 

Download fileinfo and bat_do. Use fileinfo to extract Suspicious File Information, use bat_do to pack the backup, and delete the backup files in a delayed manner.

Some files are not found, and it is suspected that Trend Micro in the computer has killed the software.

Download, install, and run the rising Card Security Assistant to clear the virus startup items.